docs: close net-scenarios green-exit task

1 files changed, 3 insertions, 1 deletions

diff --git a/todo.org b/todo.org
index 5be73aa..f4ad61b 100644
--- a/todo.org
+++ b/todo.org
@@ -1501,7 +1501,9 @@ CLOSED: [2026-07-20 Mon]
 Fixed in 36daf76: the down now runs before the rename modify (targets the stable UUID), so a failed modify under set -e can't leave a live full-tunnel VPN. Added a connection-down case to fake-nmcli and two ordering tests.
 Grading: Major severity (all traffic silently routed through Proton until manual cleanup) x rare (nmcli modify failure) = P3 = [#C].
 scripts/import-wireguard-configs.sh:51-62 imports (which brings the 0.0.0.0/0 tunnel up), renames, then deactivates; under set -e a failed modify aborts before the down, leaving the tunnel live. Fix: bring the connection down right after parsing the UUID, before the rename. See findings doc (S4).
-** TODO [#C] net-scenarios diagnose failure exits green :bug:test:solo:
+** DONE [#C] net-scenarios diagnose failure exits green :bug:test:solo:
+CLOSED: [2026-07-20 Mon]
+Fixed in cf211cd: a diagnose miss sets a per-scenario rc carried to the subshell exit, so the run fails honestly while still running fix + assert. New harness at tests/net-scenarios/ drives the real script with stubbed ssh/rsync/jq.
 Grading: Major severity (a net-doctor diagnosis regression is reported as a passing run — false green on a diagnostic tool) x rare edge case (only when a diagnosis regresses and this first-draft harness is relied on) = P3 = [#C].
 scripts/testing/run-net-scenarios.sh:103 — the scenario_diagnose_expect else-branch prints fail "...diagnose did NOT name it" but never forces a non-zero subshell exit, so ( ... ) || fails=... leaves fails unincremented and the script prints "all scenarios passed" + exit 0. Fix: exit 1 in that branch like the other two checks. See findings doc (S5).
 ** TODO [#C] pacman-hook-order test is a tautology :test:solo:quick: